Kiwi
29 CVEs tracked. None of them is in CISA KEV.
This hub aggregates every CVE we track for Kiwi. Use it to gauge the current risk picture and drill into individual advisories.
Kiwi CVEs per month
| Month | CVEs |
|---|---|
| 2024-10 | 0 |
| 2024-11 | 0 |
| 2024-12 | 0 |
| 2025-01 | 0 |
| 2025-02 | 0 |
| 2025-03 | 0 |
| 2025-04 | 0 |
| 2025-05 | 0 |
| 2025-06 | 0 |
| 2025-07 | 0 |
| 2025-08 | 0 |
| 2025-09 | 1 |
| 2025-10 | 0 |
| 2025-11 | 0 |
| 2025-12 | 0 |
| 2026-01 | 0 |
| 2026-02 | 0 |
| 2026-03 | 0 |
| 2026-04 | 0 |
| 2026-05 | 0 |
| 2026-06 | 0 |
| 2026-07 | 0 |
| 2026-08 | 0 |
| 2026-09 | 3 |
Severity
How the 29 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.
- Critical1
- High18
- Medium7
- Low1
Latest CVEs
The 15 most recently published vulnerabilities affecting Kiwi.
- CVE-2026-49292Kiwi TCMS: The /init-db/ page renders and responds to requests after first use—
- CVE-2026-55630Kiwi TCMS: Stored XSS via javascript: URI in extra_link field (TestPlan & TestCase)—
- CVE-2026-54724Kiwi TCMS: Open Redirect via unvalidated next parameter in account confirmation endpoint6.1
- CVE-2025-58790WordPress Kiwi Plugin <= 2.1.8 - Cross Site Scripting (XSS) Vulnerability6.5
- CVE-2023-36809Kiwi TCMS's misconfigured HTTP headers allow stored XSS execution with Firefox8.1
- CVE-2023-33977Stored cross site scripting (XSS) via unrestricted file upload in Kiwi TCMS8.1
- CVE-2023-32686kiwitcms vulnerable to stored XSS via unrestricted files upload8.1
- CVE-2023-30628Kiwi TCMS has command injection vulnerability in changelog.yml CI workflow8.8
- CVE-2023-30613Kiwi TCMS unrestricted file upload vulnerability8.1
- CVE-2023-30544Kiwi TCMS may allow user to update email address to unverified one3.9
- CVE-2023-27489Stored cross site scripting via SVG file upload in Kiwi TCMS7.6
- CVE-2023-25171Kiwi TCMS has denial of service vulnerability on Password reset page7.5
- CVE-2023-25156Kiwi TCMS has no protection against brute-force attacks on login page7.5
- CVE-2023-22451Weak password requirements in Kiwi TCMS6.5
- CVE-2017-17532examples/framework/news/news3.py in Kiwi 1.9.22 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct a...8.8
Product grouping is registry-driven, with AI assist and human review. How it works